A broadband access network system comprises subscriber access devices (DSLAMs or LAN SWs), a network aggregation device (ATM switch or Ethernet switch), a BAS (Broadband Access Server), and an authentication, authorization and accounting (AAA) server.
The network architecture of an existing broadband access network is shown in FIG. 1: the subscriber access devices support the subscriber lines aggregation function. The subscriber lines may be digital subscriber lines, Category 5 twisted-pairs, or optical fibers. Each subscriber access device can aggregate tens, hundreds, or thousands of subscriber lines and forward data messages from subscribers to one or a plurality of uplinks. The subscriber access devices can forward data messages from uplinks to the subscribers. The subscriber access devices typically work in L2 mode, i.e., it only processes link layer information in the data messages and forwards the messages according to the address information on the link layer. In order to ensure the security and QoS of subscriber access, the subscriber access devices usually assign a separate virtual channel on the link layer to each subscriber. In general, subscriber access devices include DSLAM devices, Ethernet switches, and wireless LAN access point devices, etc.
The network aggregation device connects the subscriber access devices to the broadband access server. The network aggregation device also works in L2 mode, i.e., it only processes link layer information in the data messages and forwards the messages according to the address information on the link layer. Since the network aggregation device has to support aggregation of many broadband subscribers, it is difficult to assign a separate virtual channel on the link layer to each subscriber; instead, it can assign a separate virtual channel on the link layer to each subscriber access device. In general, network aggregation devices include ATM switch and Ethernet switch, etc.
The broadband access server terminates the subscribers accessing link layer, i.e., it receives user ID and password, and sends them to the AAA server for authentication; if the authentication is passed successfully, the broadband access server authorizes the subscriber for Internet access. During the subscriber uses Internet, the broadband access server performs metering for the network use (duration or traffic), creates essential accounting data, and sends the data to the AAA server. The link layer protocols terminated by the broadband access server include Ethernet, ATM, and PPP protocols, etc. The broadband access server also achieves security control of subscriber's accessing network and provision of value-added services.
The AAA server stores and manages subscriber's account number and password information; during the authentication of a subscriber, it receives the subscriber's account number and password from the broadband access server, verifies them, and provide the subscriber with an authority according to the subscriber's access authority state. During the subscriber's accessing of the network, the AAA server collects the essential accounting data from the broadband access server, calculates access charge for the subscriber, and records the accounting data.
In the system shown in FIG. 1, access, aggregation, and authentication management of subscribers are implemented in three different types of devices. The three types of devices are independent to each other. During service distribution, not only the subscriber information has to be configured on the AAA server, but also subscribers-related link information is required to be configured on the three types of devices. Since all traffic of subscribers have to flow through the broadband access server, and the broadband access server has to provide duplication function for each broadband multicasting subscriber when the multicast is provided for the subscriber, thus the broadband access server will become a bottleneck of multicasting traffic.
In the existing solution of broadband access of network, the access devices are low-capacity subscriber access devices; usually, such a subscriber access device can provide accesses for tens of to hundreds of subscribers. Though the subscriber access capacity can be increased to thousands of subscribers through cascading a plurality of subscriber access devices, it is difficult to further increase the number of subscribers.
Due to the low capacity of subscriber access devices, the aggregation device has to be utilized to aggregate the subscriber access devices and then connect them to the broadband access server. In this case, the broadband access server resides on a higher network layer and manages more subscribers, resulting in the following problems: 1. the broadband access server becomes a single point of failure and a performance bottleneck; 2. the access and aggregation layers have weak control capability, the network performance is affected by the broadcasting traffic of the subscribers on the access layer, and the access layer has weak ability on anti-attacks from illegal accessed subscribers; 3. since the subscriber link layer is terminated centrally, especially in case that PPPoE protocol is used, the copy of multicasting traffic has to be accomplished at the broadband access server, resulting in a traffic bottleneck and bringing difficulty to provision of the multicasting service.
To overcome the above disadvantages, the prior art has employed a way of implementing broadband access server function at subscriber access devices. That is to say, the following functions are implemented on the access devices at the network edge: termination of the subscriber accessed link layer, authentication of subscribers, and authorization of subscriber's accessing Internet. In this way, access control of subscribers is implemented at the network edge, and thereby the performance bottleneck and single point of failure problems of central broadband access servers are overcome. Since the control of subscribers is performed at the network edge, the security of network access layer is ensured, and the broadcasting traffic from subscribers is filtered at the network edge, thereby the capacity of the access layer is increased; since the termination of subscribers is accomplished at the network edge, the problem of performance bottleneck of multicasting service is not present. However, the technical solution still has the following disadvantages:
1. difficulty in IP address planning: there are numerous subscriber access devices and each access device has to be allocated with a IP address pool separately; there are too many routes in the network due to the excessively allocated IP address pools, and therefore it is unable to enable a plurality of access devices to share the same IP address pool, resulting in waste of address resource due to unbalance address allocation. In the case of insufficient address resource, especially when the number of addresses is less than the total number of subscribers but is more than the number of concurrent access subscribers and the growth of number of concurrent access subscribers connected to each access device is unpredictable, it is difficult to plan addresses among the access devices, and thereby the situation of unavailable subscriber access often occurs locally due to insufficient addresses.
2. Difficulty in central management and reduction of operation and maintenance cost, heavy maintenance work;
3. Difficulty in cost reduction due to complicated devices on the access layer;
4. Insufficient support to value-added services due to simple access devices.